HTTP Headers Analysis for https://onet.pl

Detected Technologies from Headers

See all in URL Inspect 3

AWS CloudFront

Next.js

Ring Publishing Accelerator

HTTP Security Headers

Status

Strict-Transport-Security

Missing

Not configured

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Weak

block-all-mixed-content; report-uri Analyze

X-Frame-Options

Missing

Not configured

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Add Strict-Transport-Security header with max-age of at least 1 year
• Add Content-Security-Policy header to prevent XSS attacks
• Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Vary

Performance

Accept-Encoding

connection: close
vary: Accept-Encoding

Caching Headers

Cache-Control

Caching

s-maxage=0,stale-if-error=0,no-cache

Etag

Caching

"352901-c37fea5c9afde049"

cache-control: s-maxage=0,stale-if-error=0,no-cache
etag: "352901-c37fea5c9afde049"

Content Headers

Content-Length

Content

352901

Content-Type

Content

text/html; charset=utf-8

content-length: 352901
content-type: text/html; charset=utf-8

Server Headers

Server

Ring Publishing - Accelerator

X-Powered-By

Server

Next.js

server: Ring Publishing - Accelerator
x-powered-by: Next.js

CORS Headers

Access-Control-Allow-Credentials

Cors

true

Access-Control-Allow-Origin

Cors

https://www.onet.pl

access-control-allow-credentials: true
access-control-allow-origin: https://www.onet.pl

Cookies Headers

Set-Cookie

Cookies

set-cookie: acc_segment=84; Path=/; Max-Age=31536000; SameSite=None; Secure
acc_segment_ver=3; Path=/; Max-Age=31536000; SameSite=None; Secure

Other Headers

Alt-Svc

Other

h3=":443"; ma=86400

Date

Other

Thu, 02 Apr 2026 16:01:11 GMT

Link

Other

URL https://static.onet.pl/_next/static/css/6d52b678e2b3aa6b.css

rel=preload as=style

URL https://static.onet.pl/_next/static/css/02c62731c30074fe.css

rel=preload as=style

URL https://static.onet.pl/_next/static/css/aff3c03bdb141319.css

rel=preload as=style

URL https://static.onet.pl/_next/static/css/eae89d48666bdf9e.css

rel=preload as=style

Via

Other

1.1 383ad280f1e2a4497aecb7ee8d8e9144.cloudfront.net (CloudFront)

X-Amz-Cf-Id

Other

2DFTUUqKeG1fRbAXZ4jITkTE4-Ju6GwN5mWZILfinPfhF8P7XRc2zA==

X-Amz-Cf-Pop

Other

IAD12-P4

X-App-Build

Other

2.2.1-chi.39

X-Cache

Other

Miss from cloudfront

alt-svc: h3=":443"; ma=86400
date: Thu, 02 Apr 2026 16:01:11 GMT
link: <https://static.onet.pl/_next/static/css/6d52b678e2b3aa6b.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/02c62731c30074fe.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/aff3c03bdb141319.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/eae89d48666bdf9e.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/c56e986f1d8f9597.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/1775e96b776aea5c.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/072f466f67420bfb.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/f12e12cdd4b52083.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/2eda822fc9d03b67.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/10cb98ff450acba0.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/9ad0a26ca50ed9da.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/2ca2f62ada5e9685.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/2e394bf28ade69c1.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/c5a319e3cb1ebc89.css>; rel=preload; as=style, <https://static.onet.pl/_next/static/css/92795ce8dcea92fd.css>; rel=preload; as=style, <https://events.ocdn.eu>; rel=preconnect
via: 1.1 383ad280f1e2a4497aecb7ee8d8e9144.cloudfront.net (CloudFront)
x-amz-cf-id: 2DFTUUqKeG1fRbAXZ4jITkTE4-Ju6GwN5mWZILfinPfhF8P7XRc2zA==
x-amz-cf-pop: IAD12-P4
x-app-build: 2.2.1-chi.39
x-cache: Miss from cloudfront

Recommendations

Enable compression (gzip/brotli) to improve performance

Consider removing X-Powered-By header to hide server technology